CVE-2007-2453

Severity: low (CVSS 1.2 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-06-11 · updated 2026-06-16

Description

The random number feature in Linux kernel 2.6 before 2.6.20.13, and 2.6.21.x before 2.6.21.4, (1) does not properly seed pools when there is no entropy, or (2) uses an incorrect cast when extracting entropy, which might cause the random number generator to provide the same values after reboots on systems without an entropy source.

Affected products

Linux kernel: 2.6.0, 2.6.0-test1, 2.6.0-test10, 2.6.0-test11, 2.6.0-test2, 2.6.0-test3 (+246)

References

http://marc.info/?l=linux-kernel&m=118128610219959&w=2
http://marc.info/?l=linux-kernel&m=118128622431272&w=2
http://osvdb.org/37114
http://secunia.com/advisories/25596
http://secunia.com/advisories/25700
http://secunia.com/advisories/25961
http://secunia.com/advisories/26133
http://secunia.com/advisories/26139
http://secunia.com/advisories/26450
http://secunia.com/advisories/26620
http://secunia.com/advisories/26664
http://www.debian.org/security/2007/dsa-1356

Get alerted when CVE-2007-2453 or the next vulnerability affects your stack